Commit graph

29 commits

Author SHA1 Message Date
Timotej Lazar 32af5a43c0 Oops, missed a six 2024-05-02 17:27:18 +02:00
Timotej Lazar d123db4e64 Consolidate NAT and VPN settings into IP sets
I have tried every possible permutation and I think this is the one.

NetBox-managed IP prefixes are pushed with ansible to firewall master.
The managed prefixes are added to custom IP sets defined in the app,
but only NAT addresses and VPN groups can be configured for them.

This way all NAT and VPN policy is (again) configured in the app. Also
both NetBox-managed and user-defined networks are treated the same.

Also improve^Wtweak config generation. Also templates.
2024-04-30 20:57:46 +02:00
Timotej Lazar cac7658566 Fix handling default settings
If a setting has ben set to empty string, dict.get will return it and
not default argument. This is wrong when default is something else.
2024-04-30 09:54:39 +02:00
Timotej Lazar d33fec65a2 system: support LDAP queries with no user_group set
Though it might be better to allow multiple groups. On the other hand
the main filter is in the group→ipset settings file anyway; any VPN
user not in one of those groups will not get forwarded to anywhere.
2024-04-22 10:43:50 +02:00
Timotej Lazar c3e35777e0 Do not configure prefixes defined in NetBox
Push them to firewall nodes with ansible instead, as they will only
change in NetBox. Also don’t mess around with ipset “groups” based on
hyphenation, which was probably a bad idea.

With more data included in NetBox I am thinking we should configure
NAT and other stuff with ansible also, but let’s start small.
2024-03-18 17:37:19 +01:00
Timotej Lazar a8abf580f9 vpn: assign an IPv6 subnet instead of a single address
We are limited by the size of IPv4 pool (/18), so why not give
everyone an IPv4-internetful of IPv6 addresses.
2023-12-12 19:26:55 +01:00
Timotej Lazar bb68978b22 Clean up save_config 2023-12-10 12:32:47 +01:00
Timotej Lazar ff2246df8c vpn: configure IPv6 addresses for WG clients 2023-12-08 17:12:37 +01:00
Timotej Lazar abc7a0728b Generate ipsets for network groups
Like office and server.
2023-10-03 13:36:58 +02:00
Timotej Lazar 719bcf7c55 Improve LDAP lookup of user groups 2023-09-07 15:02:08 +02:00
Timotej Lazar 4ef3efbc68 Handle exceptions when sending mail 2023-07-07 09:04:17 +02:00
Timotej Lazar 5262c64244 Add form for editing NAT addresses 2023-07-07 08:20:35 +02:00
Timotej Lazar 8b8c675759 Rename networks.json to ipsets.json
Getting ready for some changes.
2023-07-06 16:28:15 +02:00
Timotej Lazar 5e65755ec0 Add error reporting over email and improve logging 2023-07-03 16:01:14 +02:00
Timotej Lazar b55ae4d305 Use a script on firewall nodes to update config
So we can get some feedback to firewall master.
2023-06-28 14:17:39 +02:00
Timotej Lazar 4fb2d2c732 Add version number to config tarballs
Preparing to rework the updater script.
2023-06-26 18:26:35 +02:00
Timotej Lazar 5ba9c03e23 Don’t print empty element lists in nftables
Because nft chokes on them.
2023-06-26 10:15:03 +02:00
Timotej Lazar 6780f074c7 Support IPv6 sets
Also some unrelated cleanups in system.save_config.
2023-05-29 13:00:39 +02:00
Timotej Lazar 765d4a3ce7 Add support for managing forwarding rules 2023-05-29 12:24:21 +02:00
Timotej Lazar 52a5b7cd11 Use iif/oif instead of iifname/oifname in nftables rules
Following the change in ansible scripts.
2023-05-23 11:31:13 +02:00
Timotej Lazar 22cec64bef Simplify database locking
Use a single lock for everything to ensure we don’t go inconsistent.
One exception is the firewall nodes table which is only accessed when
pushing updated config.
2023-05-19 09:30:28 +02:00
Timotej Lazar aeae0f8a29 Rework NAT settings again 2023-05-19 08:31:49 +02:00
Timotej Lazar 968a2736d2 Rework NAT settings
Support static NAT for L2 server networks. Also some other minor
tweaks.
2023-05-11 10:37:54 +02:00
Timotej Lazar 2793385693 Rename some bound variables 2023-04-07 22:51:38 +02:00
Timotej Lazar 931cd3f8c1 Store generated configs in $HOME
And move app to ~/app.
2023-04-07 14:20:54 +02:00
Timotej Lazar bba8193e14 Fix locking
Or maybe break it further.
2023-04-06 10:04:30 +02:00
Timotej Lazar 539c6ef739 Clean up imports 2023-01-26 16:28:36 +01:00
Timotej Lazar 388061130e Decrease SSH timeout when pushing config to nodes 2023-01-26 16:15:08 +01:00
Timotej Lazar 113992f95b Make a squash 2023-01-26 10:51:51 +01:00